Chapter 1 Cyber Threats Singapore Faces THREATS TO THREATS TO SMEs HEALTHCARE SECTOR In 2016, the Healthcare sector experienced the highest number of ransomware attacks compared to other sectors. Although these attacks did not affect Singapore’s overall healthcare system, they served to remind everyone to be more careful when handling files and data in their day-to-day work. Ransomware in Healthcare Sector WHEN CASE ANALYSIS Late-2016 Upon detection, affected computers were successfully isolated to prevent the ransomware infection from spreading to the wider network. As a result, there was no impact to the sector’s CII assets. The affected computers were wiped clean, had their programs reinstalled, and data restored from back-ups. BACKGROUND Immediate action by the respective institutions and the healthcare authorities helped to contain the issue. EVIDENCE Cryptoware found in system, and files were encrypted. 14 As more SMEs go digital, they may find themselves facing new threats, such as phishing attacks and defacements. Through greater awareness and some technical know-how, SMEs may be better able to defend themselves against cyber-attacks. CASE STUDY Ransomware incidents were detected in Singapore’s Healthcare sector, with individual users unable to access their files on the network. Investigations by CSA showed that these users were infected after they opened attachments or clicked on links found in e-mails they had received. HOSPITAL INVOICE TACTICS, TECHNIQUES & PROCEDURES Phishing e-mails, websites hosting malicious files. FOLLOW-UP ACTION Strengthen human security of networks and systems by increasing user awareness of ways to avoid ransomware and other malware infections. In Singapore, 43 per cent of security incidents reported to SingCERT by individuals and SMEs occurred through phishing attacks. Cyber criminals may attack SMEs as a means of getting to larger corporations, to which SMEs are suppliers. One of the most common cyber threats SMEs reported to SingCERT in 2016 was business e-mail scams. Millions of dollars were lost through phishing scams where hackers impersonated company executives or business partners via e-mail. SPF figures also showed that there was a 20 per cent rise in e-mail impersonation scams in 2016 compared to 2015. ! M A C S CASE STUDY Invoice Scam Case WHEN May 2016 BACKGROUND A Singapore company received an e-mail apparently from a known supplier, requesting for the payment for the purchase of company supplies from Japan. The company found the e-mail suspicious as it contained an unfamiliar domain name, and reported it to SingCERT. No funds were transferred to a bank in Hong Kong as requested in the e-mail, and no financial loss was reported. EVIDENCE Invoice attachments, e-mail headers. CASE ANALYSIS Results from an analysis of the e-mail headers showed that the e-mail was spoofed, and suggested that the Japanese supplier’s e-mail account might have been compromised. TACTICS, TECHNIQUES & PROCEDURES E-mail spoofing, impersonation. FOLLOW-UP ACTION SingCERT provided its findings to the Singapore company owner, and proposed that they alert the Japanese supplier of the possible compromise of its e-mail account. The company owner also lodged police reports in Singapore and Hong Kong. Such incidents are not new; SingCERT observed that several businesses have been tricked into transferring funds to scammers. It recommends SMEs to always verify details – for instance to call the supplier (telephone) first to confirm the sums – before making any funds transfer. 15